We are currently staring at a spreadsheet with 184 rows of ‘evidence’ for a security control that everyone in the room knows we haven’t actually tested since 2014. The air in the conference room is thick with the smell of dry-erase markers and the 4th cup of bitter coffee. I’m sitting across from the Internal Audit Lead, and I’m winning. I am effectively arguing that our 44-step manual validation process is the only way to ensure ‘human accountability’ across the stack. I’m using words like ‘rigor’ and ‘governance’ as if they were shields. And I won. They agreed to keep the manual checklists. But as I walked out, I felt a sickening hollow in my gut. I won the argument, but I was entirely, fundamentally wrong.

We have entered a state of ‘audit theater’ where the performance of the ritual is prioritized over the actual safety of the system. Fatima H., a crowd behavior researcher I’ve followed for years, once explained that groups in high-stress environments often default to ‘visible signaling’ when the actual goal becomes too complex to grasp. She studied how crowds in a panic don’t necessarily look for the nearest exit; they look for the person who looks most confident, even if that person is running straight into a 4-foot thick concrete wall.

The Proof of Work (PoW) of Human Misery

In the corporate world, that confident person is the one with the biggest binder. We’ve collectively decided that the size of the documentation is a proxy for the quality of the security. Fatima calls this ‘performative alignment.’ It is the act of everyone agreeing to do something useless because to stop doing it would require admitting that we’ve been wasting 34% of our operational budget for the last decade.

Think about the typical Monday for a compliance officer. They spend the morning preparing a presentation for a Tuesday meeting, which is actually just a pre-meeting for a Thursday steering committee, all to approve minutes from a meeting that happened 24 days ago. This isn’t work. We are burning our best minds to produce PDFs that will be stored in a digital vault and never read by anyone other than a junior auditor looking for a typo in the header.

The Shift: Document-First Engineering

I’ve spent the last 14 years in this industry, and I’ve seen the shift happen slowly. It used to be that the audit was the check on the work. Now, the work is the preparation for the audit. The actual configuration of the server, the hardening of the database, the encryption of the data-those are afterthoughts. The primary goal is to ensure that when the auditor asks for ‘Proof of X,’ we can produce it within 4 minutes. This has created a culture of ‘document-first’ engineering. We build systems that are easy to audit, not systems that are hard to hack.

Fatima H.’s research shows that when a crowd is forced into a bottleneck, the pressure doesn’t just come from the front; it comes from the collective push of everyone trying to prove they are moving. In our case, the ‘push’ is the manual evidence generation. We are crushing our own people under the weight of proving they are working. This leads to massive burnout, which leads to turnover, which leads to-you guessed it-more documentation to ‘onboard’ the next sacrificial lamb.

The True State: A Pulse, Not a Filing Cabinet

We need to stop confusing the evidence of compliance with the state of being compliant. A report is a snapshot of a moment in time, often highly curated and sanitized. Actual compliance is a continuous, living state of the system. It’s a pulse, not a filing cabinet.

The irony of my ‘victory’ in that argument last month is that I was fighting for the very thing that makes us less secure. By demanding manual checklists, I was demanding that my team spend less time actually monitoring the systems and more time performing for me.

This is the friction point where platforms like MAS digital advertising guidelines enter the conversation, not as another tool to manage, but as a way to dissolve the need for manual evidence altogether. The goal should be ‘Zero-Touch Compliance,’ where the evidence is a byproduct of the work, not the work itself.

The Cost of Clerical Rituals

If we reallocated just 24% of the time spent on manual compliance back into actual security research and development, we would move the needle on global cybersecurity more than any regulation ever has. We are effectively subsidizing the audit industry with our own stagnation.

Fatima H.’s research shows that the only way to break a ‘performative alignment’ is to introduce a new signal that is easier to follow than the old ritual. We have to make automation more ‘visible’ and more ‘trustworthy’ than the paper binder. We need to move from ‘Trust, but Verify’ to ‘Verify, then Trust the System.’

The Crossroads: Binders or Breathability

I think back to that meeting on the 14th floor. If I could go back, I would concede the argument. I would admit that my fear of losing control was driving me to demand more manual oversight. I would acknowledge that the 184 rows in our spreadsheet are just a comfort blanket for the board of directors. I would tell them that we are drowning, and the only way to swim is to let go of the paper weights we’ve been clutching so tightly.

We are at a crossroads. We can continue to perform the ritual, adding more layers of ‘Proof of Work’ until the entire system collapses under its own weight, or we can embrace a future where compliance is invisible because it is inherent. We can keep our 44-step checklists, or we can actually manage the risk.

The choice seems obvious, yet we cling to the binders. We cling to the meetings about meetings. We cling to the ‘Proof’ because we’ve forgotten what the ‘Work’ actually was. The next time you’re asked to provide evidence for a control, ask yourself: Does this prove we are safe, or does it just prove we are busy? If the answer is the latter, it’s time to stop the theater.